Owen Mansel-Chan
a8112ec62e
Add neutralModel to empty.model.yml so it is defined somewhere
2024-06-04 11:45:57 +01:00
Owen Mansel-Chan
adfaae02e7
Cache interpretElement
2024-06-04 11:45:55 +01:00
Owen Mansel-Chan
479ea9f82c
Remove unused predicate hasExternalSpecification
2024-06-04 11:45:54 +01:00
Owen Mansel-Chan
174712a472
Delete unused predicate paramsString
...
This is needed for other languages, but in Go you cannot have two
functions which are distinguished only by their parameter types.
2024-06-04 11:45:52 +01:00
Owen Mansel-Chan
40127583fb
Make manual neutral summary models block generated summary models
2024-06-04 11:45:51 +01:00
Owen Mansel-Chan
5b04a71169
Non-trivial implementation of NeutralCallableAdapter
2024-06-04 11:45:49 +01:00
Owen Mansel-Chan
df8e04fcf9
Add predicate neutralElement matching summaryElement
2024-06-04 11:45:48 +01:00
Owen Mansel-Chan
209fe731a6
Change type of c to be more portable
2024-06-04 11:45:47 +01:00
Owen Mansel-Chan
e2008e14e2
Move summaryElement to FlowSummyImpl.qll
2024-06-04 11:45:45 +01:00
Owen Mansel-Chan
7f0f2d3438
Rename interpretSummary to summaryElement
2024-06-04 11:45:44 +01:00
Owen Mansel-Chan
961b09d63c
Use methods of AccessPathToken more
2024-06-04 11:45:42 +01:00
Owen Mansel-Chan
9f7c47509a
Expect "receiver" instead of "-1"
2024-06-04 11:45:41 +01:00
Owen Mansel-Chan
557adaf6f2
Update invalid model predicates
2024-06-04 11:45:40 +01:00
Owen Mansel-Chan
8e2e32742c
Use neutralModel in various places
2024-06-04 11:45:38 +01:00
Owen Mansel-Chan
83672f545f
Add neutralModel extensible predicate
2024-06-04 11:45:36 +01:00
Owen Mansel-Chan
a71e678bb9
Change imports
2024-06-04 11:45:33 +01:00
Owen Mansel-Chan
c3e1592815
Use AccessPath and AccessPathToken more
2024-06-04 11:45:27 +01:00
Owen Mansel-Chan
54a0c03e5d
Rename canonicalPackageHasASubpackage to canonicalPkgLink
2024-06-04 11:45:25 +01:00
Owen Mansel-Chan
e81a98925a
Remove QLDoc
2024-06-04 11:45:20 +01:00
Owen Mansel-Chan
797e5d0c8a
Rename packageHasASubpackage to packageLink
2024-06-04 11:45:17 +01:00
Owen Mansel-Chan
7c94120eb7
Rename packageHasMaDCoverage to relevantPackage
2024-06-04 11:45:13 +01:00
Owen Mansel-Chan
89e7bab0b3
QLDoc
2024-06-04 11:45:06 +01:00
Owen Mansel-Chan
133983678c
Merge pull request #16619 from owen-mc/go/fix/response-writer-variadic
...
Go: Fix bug in ResponseWriter for variadic MaD
2024-06-04 05:36:58 +01:00
Chuan-kai Lin
8d5bb21643
Merge pull request #16642 from github/post-release-prep/codeql-cli-2.17.4
...
Post-release preparation for codeql-cli-2.17.4
2024-05-31 09:08:03 -07:00
github-actions[bot]
a19149032f
Post-release preparation for codeql-cli-2.17.4
2024-05-31 14:49:11 +00:00
github-actions[bot]
a22e70373a
Release preparation for version 2.17.4
2024-05-31 13:40:51 +00:00
Owen Mansel-Chan
d112073a13
Edit change note
2024-05-30 21:04:05 +01:00
Owen Mansel-Chan
a5c392ed4b
Add back taint models for append and copy
...
This is needed when they are used with string arguments.
2024-05-30 21:01:03 +01:00
Chuan-kai Lin
b41835a7d9
Revert "Release preparation for version 2.17.4"
2024-05-30 09:25:15 -07:00
Owen Mansel-Chan
1d9a98614a
Fix bug in ResponseWriter for variadic MaD
...
`getSummaryInputOrOutputNode` was giving the summary component stack for
arguments corresponding to variadic parameters. This will be a problem
when the models for variadic functions are converted to models-as-data.
2024-05-29 21:15:49 +01:00
Anders Schack-Mulligen
2f95851537
Merge pull request #16603 from aschackmull/dataflow/location
...
Dataflow/Go: Add getLocation to DataFlowCall and DataFlowCallable for easier debugging.
2024-05-29 08:58:22 +02:00
github-actions[bot]
906b65d09c
Post-release preparation for codeql-cli-2.17.4
2024-05-28 18:02:25 +00:00
github-actions[bot]
33b4ae8bbb
Release preparation for version 2.17.4
2024-05-28 15:44:32 +00:00
Anders Schack-Mulligen
3b12f69dd9
Dataflow/Go: Add getLocation to calls and callables for easier debugging.
2024-05-28 13:47:08 +02:00
Anders Schack-Mulligen
1432519cc2
Dataflow: Add totalorder predicates to all languages.
2024-05-27 11:01:52 +02:00
Anders Schack-Mulligen
bc8ca1af86
Dataflow: Introduce NodeRegions for use in isUnreachableInCall.
2024-05-27 11:01:51 +02:00
Dave Bartolomeo
613ccaac1d
Add change note to all v1.0.0 packs
2024-05-23 13:01:22 -04:00
Owen Mansel-Chan
b2deea4606
Avoid duplicate additional flow steps in configs
...
`localTaintStep` includes a lot of steps which are already part of value
flow. Instead use `defaultAdditionalTaintStep`, which is just the extra
steps that are added for taint tracking.
2024-05-23 11:13:35 +01:00
Owen Mansel-Chan
cf997fddf6
Trivial: improve parameter names
...
These names make more sense and match everywhere
else that this function signature is used.
2024-05-23 11:04:09 +01:00
Dave Bartolomeo
ffe4c8c87b
Update all pack versions to 1.0.0
2024-05-22 13:39:08 -04:00
Tom Hvitved
454687d583
Data flow: Synthesize parameter return nodes
2024-05-21 14:47:42 +02:00
Erik Krogh Kristensen
bfc95c6f13
Merge pull request #16510 from erik-krogh/go-command
...
Go: Update the QHelp for `go/command-injection`.
2024-05-17 17:45:10 +02:00
erik-krogh
384649b336
changes based on review, and improve the new command-injection test
2024-05-17 08:38:54 +02:00
Owen Mansel-Chan
2dd42f7aa5
Merge pull request #16509 from owen-mc/go/fix-missing-underlying-types
...
Go: make two barriers recognise named types whose underlying types are integer types
2024-05-16 12:41:42 +01:00
Owen Mansel-Chan
8cc118f781
Add change note
2024-05-16 11:16:54 +01:00
Owen Mansel-Chan
b008f98782
Fix missing getUnderlyingType() calls
...
In both cases we also care about named types whose underlying type is
an integer type.
2024-05-16 11:10:15 +01:00
Owen Mansel-Chan
e71cf0ff1d
Use value flow instead of taint flow
2024-05-16 10:10:18 +01:00
Owen Mansel-Chan
5dbb91f508
Merge pull request #16504 from owen-mc/go/allow-array-reads-from-named-types
...
Go: allow read and store steps from named types
2024-05-16 09:47:54 +01:00
erik-krogh
ea2b73bda2
add a sanitizer that checks that the string does not start with "--"
2024-05-16 09:25:19 +02:00
erik-krogh
b9a7f6a8f7
add regexp check as a sanitizer for command-injection
2024-05-16 08:55:03 +02:00
